Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some Google Photos videos in backups were sent to strangers in November

ww.9to5google.com

Post reply on HN
Print view View original

101–110 of 143 posts

Re: Some Google Photos videos in backups were sent to strangers in November

#101

Post by KMag »

dehrmann wrote: post #64
SnowingXIV wrote: post #4

How does this happen? I realize it's a small percentage, but this is one of the first tests you build. Even 1 photo (not to mention this is regarding videos) should never make it to another non-authenticated user. This is a massive mistake.

One way I've seen this happen is images have UUIDs (or just incrementing), they're base-64 encoded somewhere after security checks, and someone accidentally called `toLower()` on the id.

Going from 22 base-64 characters to 22 base-36 characters still only drops you to about 113 bits of entropy. Unless we're talking significantly more than a quadrillion images in the system, getting a collision on a 113-bit random ID is exceedingly unlikely.

I strongly suspect there were more problems in the system than just toLower(), or else the system was hosting significantly more than a quadrillion images. Your mention of "or just incrementing" sounds much closer to the mark.

Re: Some Google Photos videos in backups were sent to strangers in November

#102

Post by danielrhodes »

brenden2 wrote: post #11

The usual argument for using "cloud" over managing your own files/data is that it's very hard to safely manage your own data without making mistakes (data loss, etc). However, this is an example of how companies like Google also make mistakes. Furthermore, when Google/FB makes a mistake (like leaking your private data) they do it at a global scale. I offboarded myself from all of Google's services a while ago, but I…

> I don't trust, and never will trust, any company to hold on to my data without either selling it to a third party or accidentally leaking it.

This is a very black and white way of looking at trust. Trust is earned, it can be broken, it can be rebuilt. All human relationships are built upon trust, and it is fallible just like anything else. To have trust is to create vulnerability. However, just as you mention, that vulnerability comes with an upside.

What you are saying is: because there is vulnerability in trust, you should trust no one.

Re: Some Google Photos videos in backups were sent to strangers in November

#103

Post by colejohnson66 »

jliptzin wrote: post #72
colejohnson66 wrote: post #67

Earlier quoted context omitted.

And when the average user forgets their password?

Don’t be the average user.

That’s a very dismissive attitude. If you want to make the world a better place, you have to accommodate the average user; One can’t say, “you’re not smart enough for our service.”

Re: Some Google Photos videos in backups were sent to strangers in November

#104

Post by msh »

dyingkneepad wrote: post #77
thedance wrote: post #52

Earlier quoted context omitted.

I get an absolutely endless parade of other people's data to my gmail account. Doctors send me MRI scans. Bankers send me foreclosure notices. Airlines send me tickets. Undertakers send me condolences. The preponderance of evidence suggests that relying on individual vigilance on a large scale does not work as well as relying on the vigilance of large organizations.

Your experience is far different than mine. In 15 years I only got probably like 2 accidental emails. Is your email something like john@gmail.com?

I have firstname + two letters @gmail which rarely gets wrong email but then back from the nineties got firstnamelastname @ Hotmail.com which properly get at least one misdirected mail a month.

Re: Some Google Photos videos in backups were sent to strangers in November

#105

Post by msh »

pgt wrote: post #25
brenden2 wrote: post #11

The usual argument for using "cloud" over managing your own files/data is that it's very hard to safely manage your own data without making mistakes (data loss, etc). However, this is an example of how companies like Google also make mistakes. Furthermore, when Google/FB makes a mistake (like leaking your private data) they do it at a global scale. I offboarded myself from all of Google's services a while ago, but I…

What did you replace Gmail and GDocs with? I've successfully moved to Firefox and DuckDuckGo, but am struggling to get off Docs and Gmail.

Word online is free.

Re: Some Google Photos videos in backups were sent to strangers in November

#106

Post by oarsinsync »

danielrhodes wrote: post #102
brenden2 wrote: post #11

The usual argument for using "cloud" over managing your own files/data is that it's very hard to safely manage your own data without making mistakes (data loss, etc). However, this is an example of how companies like Google also make mistakes. Furthermore, when Google/FB makes a mistake (like leaking your private data) they do it at a global scale. I offboarded myself from all of Google's services a while ago, but I…

> I don't trust, and never will trust, any company to hold on to my data without either selling it to a third party or accidentally leaking it. This is a very black and white way of looking at trust. Trust is earned, it can be broken, it can be rebuilt. All human relationships are built upon trust, and it is fallible just like anything else. To have trust is to create vulnerability. However, just as you mention, that…

> All human relationships are built upon trust

Relationships with corporations are not the same as human relationships. Being open with other humans is part of the human experience.

Being open with special legal entities that we have fabricated as societies for economic gain is justifiably questionable.

Re: Some Google Photos videos in backups were sent to strangers in November

#107

Post by jkaunisv1 »

addajones wrote: post #95
jkaunisv1 wrote: post #51

Earlier quoted context omitted.

Emails were deleted August 23rd, across a wide variety of folders, all at the same millisecond (when I later pointed this out and how difficult it would be for me to do this accidentally, they did not comment). Noticed on October 4th. I'd noticed some emails weren't turning up in searches but I chalked it up to my bad memory until there was one I knew for a fact should have been there. It was Oct 22nd by the time we…

Where are you hosting Mailinabox? I've always wanted to use it instead of gmail/fastmail but all I find are the generic use DigitalOcean, etc tutorials and I'm wondering what somebody actually using it has it set up with, what are the specs? Thanks in advance!

I had an extra Linode instance (Nanode 1GB: 1 CPU, 25GB Storage, 1GB RAM) laying around that I'd previously tried to manually set up a mailserver on. So I just reset it to the OS/version Mailinabox specifies, ran the install script and followed the rest of the instructions (https://mailinabox.email/guide.html)

It really doesn't need much, and the guide is very complete. Took me a Thursday evening plus some waiting for DNS propagation.

Re: Some Google Photos videos in backups were sent to strangers in November

#108

Post by Phrenzy »

jimbob45 wrote: post #13
brenden2 wrote: post #11

The usual argument for using "cloud" over managing your own files/data is that it's very hard to safely manage your own data without making mistakes (data loss, etc). However, this is an example of how companies like Google also make mistakes. Furthermore, when Google/FB makes a mistake (like leaking your private data) they do it at a global scale. I offboarded myself from all of Google's services a while ago, but I…

What do you use for email over Gmail?

Runbox.com

Re: Some Google Photos videos in backups were sent to strangers in November

#109

Post by x__x »

londons_explore wrote: post #90

Considering this is 4 months later... This can't have been very widespread. If I saw someone else's video in my takeout archive, I'd have totally contacted the tech media...

What if it was a celebrity? This kind of thing could have been used for blackmail

Re: Some Google Photos videos in backups were sent to strangers in November

#110

Post by mceachen »

climb_stealth wrote: post #97
mceachen wrote: post #84

Earlier quoted context omitted.

> How are photos added to the library? PhotoStructure imports files that are available to the device that it runs on: local files and anything mounted via a network filesystem (like AFS, NFS, or SMB/CIFS). I use SyncThing or Resilio Sync to send my phone's photos and videos to my NAS. When I'm on vacation with limited bandwidth, I add a sync node on my laptop (which is connected to the hotel WiFi), so my phone syncs…

I see, thanks! And yes, I agree on the app part. Which is where Google Photos' value lies for me as it is rock solid in that department. I'm currently running both syncthing and Google Photos to store my photos. syncthing is great once it works, but it is definitely not something I would expect a family member to be able to set up. In any case I'm very much looking forward to see where PhotoStructure is going. I've s…

FWIW, Resilio Sync has a desktop version that's easy to set up (a QR code pairs your devices, and you don't have to do anything to your router).
Post reply on HN